Live › vulnerability › CVE-2026-114049
Go to dashboardvLLM before 0.31.0 fails to clear per-request allowed_token_ids masks when batch slots are recycled in InputBatch.condense(). A remote attacker can make other clients' unrestricted generation requests inherit a token allowlist, constraining their outputs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running vLLM as a shared inference server that handles concurrent constrained generation requests from multiple clients, especially where /invocations is exposed without authentication. Single-user or isolated deployments that never mix constrained and unconstrained requests are much less exposed.
No product ranges from the sources yet.
pip show vllm or python -c "import vllm; print(vllm.__version__)"0.31.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_ids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so recycled batch slots apply their token allowlist to victims' unrestricted requests.
This page as .md · .json · in your agent: get_signal("CVE-2026-114049")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.